Analysis
- max time kernel
65s - max time network
45s - platform
windows7_x64 - resource
win7-20220414-en - submitted
15/06/2022, 05:40
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.7527.exe
- Size 574KB
- Sample220615-gcwdvsbeg4
- SHA256 ff073d05223a456c06707ad4be71853e996524b5a5b8b118a977feb6bce9992c
Malware Config
Extracted
-
xloader
-
2.6
-
be3s
-
aoxaswa.info
-
souplab-graphic.com
-
churchontheisland.com
-
spclassic-cars.com
-
stanford-edu.club
-
heydowm.online
-
chattanooga-electricians.com
-
sectsk.com
-
cxg98.com
-
buildafricaonline.net
-
buydogcoin.com
-
vsst247.com
-
lodgelastrancas.com
-
ainonaho.com
-
griousndwarehsftyfs.xyz
-
voltagestabilizersupply.com
-
xn--79q565dzfex9hg81b.com
-
isrvr-ccrforum.info
-
chitiandi.com
-
criticaldisco.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7527.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1100-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1100-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1100-64-0x00000000009C0000-0x0000000000CC3000-memory.dmp
memory/1380-54-0x0000000001040000-0x00000000010D6000-memory.dmp
memory/1380-55-0x0000000075871000-0x0000000075873000-memory.dmp
memory/1380-56-0x0000000000310000-0x000000000031C000-memory.dmp
memory/1380-57-0x00000000047F0000-0x000000000485A000-memory.dmp
memory/1380-58-0x00000000008D0000-0x0000000000902000-memory.dmp